This is right. So many incentives are stacked in favor of making false attributions, specifically to enemy state actors:

- real attacker doesn't want to get caught

- victim doesn't want to admit being pwned by a script kiddy or petty criminal

- military-industrial complex needs foreign threat inflation to stay in business

- media loves the intrigue

The pushback would come from the foreign state being falsely slandered, but they never get a say anyways.